@@ -, +, @@ installations - generates letsencrypt certificates - sets up a https-only website - redirects 80 to https (not yet) - build a debian package with all patches for bug 15303 applied - checkout letsencrypt on the vm where you are testing the package git clone https://github.com/letsencrypt/letsencrypt - install koha with your new package - use koha-create with the new options: sudo koha-create --create-db --force-https --letsencrypt /home/mirko/letsencrypt - wait until setup is finished, check that you got a working OPAC and staff client with certificates - use letsencrypt default path in debian when we know where that is - enable redirect from port 80 to https in apache config --- debian/docs/koha-create.xml | 17 +++++++ debian/scripts/koha-create | 32 +++++++++++-- debian/templates/apache-site-https.conf.in | 68 ++++++++++++++++++++++++++++ 3 files changed, 114 insertions(+), 3 deletions(-) create mode 100644 debian/templates/apache-site-https.conf.in --- a/debian/docs/koha-create.xml +++ a/debian/docs/koha-create.xml @@ -40,6 +40,8 @@ port directory + + directory | instancename @@ -177,6 +179,21 @@ + + + Set up a https-only website + + + + + + + Specify the where letsencrypt-auto lives + It defaults to /path/to/letsencrypt. + + + + , Print usage information. --- a/debian/scripts/koha-create +++ a/debian/scripts/koha-create @@ -71,6 +71,8 @@ Options: conjunction with --defaultsql and --populate-db. --upload-path dir Set a user defined upload_path. It defaults to /var/lib/koha//uploads + --force-https Set up a https-only site with letsencrypt certificates + --letsencrypt Path to the letsencrypt folder --help,-h Show this help. Note: the instance name cannot be longer that 11 chars. @@ -354,6 +356,9 @@ END_BIBLIOS_RETRIEVAL_INFO="" START_AUTHORITIES_RETRIEVAL_INFO="" END_AUTHORITIES_RETRIEVAL_INFO="" +APACHE_CONFIGFILE="" +LETSENCRYPT_PATH="" + if [ -e /etc/koha/koha-sites.conf ] then . /etc/koha/koha-sites.conf @@ -361,7 +366,7 @@ fi [ $# -ge 1 ] && [ $# -le 16 ] || ( usage ; die "Error: wrong parameters" ) -TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:, \ +TEMP=`getopt -o chrpm:l:d:f:b:a: -l create-db,request-db,populate-db,use-db,use-memcached,enable-sru,sru-port:,help,marcflavor:,auth-idx:,biblio-idx:,zebralang:,defaultsql:,configfile:,passwdfile:,database:,adminuser:,memcached-servers:,memcached-prefix:,upload-path:,force-https,letsencrypt:, \ -n "$0" -- "$@"` # Note the quotes around `$TEMP': they are essential! @@ -378,7 +383,6 @@ CLO_MEMCACHED_SERVERS="" CLO_MEMCACHED_PREFIX="" CLO_UPLOAD_PATH="" - while true ; do case "$1" in -c|--create-db) @@ -419,6 +423,10 @@ while true ; do SRU_SERVER_PORT="$2" ; shift 2 ;; --upload-path) CLO_UPLOAD_PATH="$2" ; shift 2 ;; + --force-https) + USE_HTTPS="yes" ; shift ;; + --letsencrypt) + LETSENCRYPT_PATH="$2" ; shift 2 ;; -h|--help) usage ; exit 0 ;; --) @@ -598,8 +606,13 @@ FLUSH PRIVILEGES; eof fi #` + if [ "$USE_HTTPS" = "yes" ]; then + APACHE_CONFIGFILE="apache-site-https.conf.in" + else + APACHE_CONFIGFILE="apache-site.conf.in" + fi # Generate and install Apache site-available file and log dir. - generate_config_file apache-site.conf.in \ + generate_config_file $APACHE_CONFIGFILE \ "/etc/apache2/sites-available/$name.conf" mkdir "/var/log/koha/$name" chown "$username:$username" "/var/log/koha/$name" @@ -708,6 +721,19 @@ then # Start Indexer daemon koha-indexer --start "$name" fi + + if [ "$USE_HTTPS" = "yes" ]; then + # Get letsencrypt certificates + # TODO: fix path of letsencrypt + $LETSENCRYPT_PATH/letsencrypt-auto --agree-tos --renew-by-default --webroot --server https://acme-v01.api.letsencrypt.org/directory certonly -w /usr/share/koha/opac/htdocs/ -d $opacdomain -w /usr/share/koha/intranet/htdocs/ -d $intradomain + # enable all ssl settings (apache won't start with these before certs are present) + sed -i "s:^\s*#\(\s*SSL.*\)$:\1:" "/etc/apache2/sites-available/$name.conf" + # change port from 80 to 443. (apache won't start if it is 443 without certs present) + sed -i "s:^\s*\( #https$:\1443>:" "/etc/apache2/sites-available/$name.conf" + # TODO: enable forward from 80 to https + # restart apache with working certs + service apache2 restart + fi fi --- a/debian/templates/apache-site-https.conf.in +++ a/debian/templates/apache-site-https.conf.in @@ -0,0 +1,68 @@ +# Koha instance __KOHASITE__ Apache config. + +# #nohttps +# RewriteEngine On +# RewriteCond %{HTTPS} !=on +# RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L] +# + + +# OPAC + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-SA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-opac-plack.conf + Include /etc/koha/apache-shared-opac.conf + + ServerName __OPACSERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/opac-error.log +# TransferLog /var/log/koha/__KOHASITE__/opac-access.log +# RewriteLog /var/log/koha/__KOHASITE__/opac-rewrite.log + + +# Intranet + #https +# SSLEngine on +# SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1 +# SSLCompression off +# SSLHonorCipherOrder on +# SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA" +# SSLCertificateKeyFile /etc/letsencrypt/live/__OPACSERVER__/privkey.pem +# SSLCertificateFile /etc/letsencrypt/live/__OPACSERVER__/cert.pem +# SSLCertificateChainFile /etc/letsencrypt/live/__OPACSERVER__/chain.pem + + = 2.4> + Define instance "__KOHASITE__" + + Include /etc/koha/apache-shared.conf +# Include /etc/koha/apache-shared-disable.conf +# Include /etc/koha/apache-shared-intranet-plack.conf + Include /etc/koha/apache-shared-intranet.conf + + ServerName __INTRASERVER__ + SetEnv KOHA_CONF "/etc/koha/sites/__KOHASITE__/koha-conf.xml" + SetEnv MEMCACHED_SERVERS "__MEMCACHED_SERVERS__" + SetEnv MEMCACHED_NAMESPACE "__MEMCACHED_NAMESPACE__" + AssignUserID __UNIXUSER__ __UNIXGROUP__ + + ErrorLog /var/log/koha/__KOHASITE__/intranet-error.log +# TransferLog /var/log/koha/__KOHASITE__/intranet-access.log +# RewriteLog /var/log/koha/__KOHASITE__/intranet-rewrite.log + --